kairos
https://github.com/kairos-io/kairos
Go
:penguin: The immutable Linux meta-distribution for edge Kubernetes.
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
Go not yet supported1 Subscribers
Add a CodeTriage badge to kairos
Help out
- Issues
- reset is the only subcommand with no --strict-validation, so a bad reset: block is always just a warning
- Encrypted OEM: the kcrypt TPM settings are read from kcrypt.challenger and written to a cmdline key nothing reads, so nv_index, c_index and tpm_device never reach the boot
- fix(immucore): ask whether the extension link exists, not whether it resolves
- Trusted Boot: go-ukify signs three of the four .pcrsig banks with the wrong hash, so a non-sha256 TPM bank can never unseal
- immucore: a sysext name present in both the boot-state and common directories fails the boot, because the already-enabled guard stats through a dangling link
- docs(operator): nameOverride.uki is documented as appending a -uki suffix, which the operator stopped doing in v0.2.0
- go-ukify: --sb-key without --sb-cert silently produces an unsigned UKI and exits 0
- go-ukify: the unsigned UKI output path is rewritten across the whole path, so the artifact lands where the caller never asked
- go-ukify: --sb-key rejects a PKCS#1 RSA key that --pcr-key accepts, and --pcr-key panics on a non-RSA PKCS#8 key
- go-ukify: the objcopy binary is a hardcoded name from $PATH, so a cross-architecture UKI build has no seam and the --arch it would use is read nowhere
- Docs
- Go not yet supported